Ensure Allowlist violations are enabled

中级别 2自动化aix

说明

This takes allowlist aka whitelisting to the next level - where all software, libraries and scripts that are not in the trusted signature database (TSD) in /etc/security/tsd/tsd.dat are blocked. Trusted Execution (TE) provides an additional layer of access controls to processes on top of the base Discretionary Access Controls. Monitoring how processes access system resources can improve awareness of system integrity. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

检查方式

审计方法: Shell 命令

shell

command -v trustchk >/dev/null 2>&1 || exit 1; out=$(trustchk -p stop_untrustd stop_on_chkfail te 2>/dev/null) || exit 1; r=compliant; for p in '^STOP_UNTRUSTD=(ON|TROJAN)$' '^STOP_ON_CHKFAIL=ON$' '^TE=ON$'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Execute one of the following commands: trustchk -p stop_untrustd=on stop_on_chkfail=on te=on or trustchk -p stop_untrustd=trojan stop_on_chkfail=on te=on

属性

操作系统: 任意
标签: aixhardening
参考: CIS IBM AIX 7 Benchmark v1.2.0 - 2.5 Ensure Allowlist violations are enabled

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target aix --level 2